Re: [PATCH] mm: check the return value of lookup_page_ext for all call sites

Shi, Yang
2016-06-01T20:40:53Z

On 5/29/2016 11:11 PM, Minchan Kim wrote:
> On Fri, May 27, 2016 at 11:16:41AM -0700, Shi, Yang wrote:
>
> <snip>
>
>>>
>>> If we goes this way, how to guarantee this race?
>>
>> Thanks for pointing out this. It sounds reasonable. However, this
>> should be only possible to happen on 32 bit since just 32 bit
>> version page_is_idle() calls lookup_page_ext(), it doesn't do it on
>> 64 bit.
>>
>> And, such race condition should exist regardless of whether DEBUG_VM
>> is enabled or not, right?
>>
>> rcu might be good enough to protect it.
>>
>> A quick fix may look like:
>>
>> diff --git a/include/linux/page_idle.h b/include/linux/page_idle.h
>> index 8f5d4ad..bf0cd6a 100644
>> --- a/include/linux/page_idle.h
>> +++ b/include/linux/page_idle.h
>> @@ -77,8 +77,12 @@ static inline bool
>> test_and_clear_page_young(struct page *page)
>> static inline bool page_is_idle(struct page *page)
>> {
>> struct page_ext *page_ext;
>> +
>> + rcu_read_lock();
>> page_ext = lookup_page_ext(page);
>> + rcu_read_unlock();
>> +
>> if (unlikely(!page_ext))
>> return false;
>>
>> diff --git a/mm/page_ext.c b/mm/page_ext.c
>> index 56b160f..94927c9 100644
>> --- a/mm/page_ext.c
>> +++ b/mm/page_ext.c
>> @@ -183,7 +183,6 @@ struct page_ext *lookup_page_ext(struct page *page)
>> {
>> unsigned long pfn = page_to_pfn(page);
>> struct mem_section *section = __pfn_to_section(pfn);
>> -#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAGE_POISONING)
>> /*
>> * The sanity checks the page allocator does upon freeing a
>> * page can reach here before the page_ext arrays are
>> @@ -195,7 +194,7 @@ struct page_ext *lookup_page_ext(struct page *page)
>> */
>> if (!section->page_ext)
>> return NULL;
>> -#endif
>> +
>> return section->page_ext + pfn;
>> }
>>
>> @@ -279,7 +278,8 @@ static void __free_page_ext(unsigned long pfn)
>> return;
>> base = ms->page_ext + pfn;
>> free_page_ext(base);
>> - ms->page_ext = NULL;
>> + rcu_assign_pointer(ms->page_ext, NULL);
>> + synchronize_rcu();
>
> How does it fix the problem?
> I cannot understand your point.

Assigning NULL pointer to page_Ext will be blocked until rcu_read_lock
critical section is done, so the lookup and writing operations will be
serialized. And, rcu_read_lock disables preempt too.

Yang

>
>> }
>>
>> static int __meminit online_page_ext(unsigned long start_pfn,
>>
>> Thanks,
>> Yang
>>
>>>
>>> kpageflags_read
>>> stable_page_flags
>>> page_is_idle
>>> lookup_page_ext
>>> section = __pfn_to_section(pfn)
>>> offline_pages
>>> memory_notify(MEM_OFFLINE)
>>> offline_page_ext
>>> ms->page_ext = NULL
>>> section->page_ext + pfn
>>>
>>>>
>>>> Thanks.
>>>>
>>